Industries
Most of my last two decades of work happened inside organizations where a control failure is a regulatory event. That's the context this practice is built for.
HIPAA control environments, protected health data, and vulnerability estates measured in five figures. Program leadership at Evernorth Health Services (Cigna), operating across the Cigna Information Protection organization, Global Infrastructure & Operations, and Audit simultaneously.
SOX and PCI-DSS obligations, regulator attention, and no tolerance for a missed remediation date. Emergency vulnerability response, executive risk reporting, and ITIL service governance built inside Wells Fargo and GE Capital.
Multi-country infrastructure, data center consolidation, and shared-services programs delivered at Altria Corporate Services, including a flagship global network and data center program across five countries delivered three months ahead of schedule.
Senior platform engineering without the headcount. The same operating discipline applied at a smaller scale, for teams that need the system to be legible long before it needs to be large.
Frameworks
These are the regimes the programs above were audited against.
Every engagement starts with a conversation about outcomes, not hours. If I'm not the right fit, I'll be the first person to tell you.